HPE7-A02 Aruba Certified Network Security Professional Exam Topics and Questions

This is the largest single slice of the exam, and it sets the conceptual foundation everything else rests on. The domain mixes vendor-neutral theory with Aruba-specific implementation, so the danger is knowing one side and not the other. Expect to apply ideas rather than recite them: PKI, Zero Trust, dynamic segmentation, VPN, and WIPS all appear here, and the exam tests whether you can reason with them under scenario pressure.

– Identity, profiling, and policy enforcement

PKI dependencies are worth pinning down precisely. The chain of trust, certificate revocation, and how certificates drive IKE authentication in IPsec tunnels all appear in scenario questions. Profiling matters because the exam tests both the method and the outcome: active probing tells you what a device claims to be, passive listening tells you what it actually does, and the gap between the two is where policy decisions get made.

ClearPass Policy Manager (CPPM) sits at the centre of the enforcement picture. The exam expects you to understand how CPDI identifies and tags traffic flows and how CPPM reads those tags to trigger actions. That chain from classification to enforcement to action is the sequence the exam probes. Log types and levels are part of this picture too: the ingress event engine in CPPM is the integration point for third-party logging solutions, and you need to know which log source feeds which kind of event.

– Segmentation, wireless security, and VPN

Dynamic segmentation is one of the most frequently tested ideas in this domain. The exam focuses on the benefits and use cases rather than button-by-button configuration, so concentrate on why segmentation decisions are made at the policy layer rather than the port layer, and what that buys an organisation in terms of lateral movement control.

WIPS and WIDS are distinct functions and the exam treats them that way. The Aruba 9x00 Series appears in context of how dedicated sensor hardware extends wireless intrusion coverage beyond what an AP can offer while serving clients. Know the architectural difference.

Zero Trust with Aruba solutions means understanding how the portfolio maps to the verify-explicitly, least-privilege, and assume-breach principles. The exam tests which Aruba component addresses which vector rather than asking you to define Zero Trust in the abstract.

For VPN, the examinable details are protocol selection (IKEv1 versus IKEv2, ESP versus AH), algorithm choices, certificate-based authentication within IKE, and how reauth intervals affect session continuity. Deployment type differences (site-to-site, remote access, hub-and-spoke) are fair game at the design level.

How Define security terminology is tested

At 26% of the exam, this domain will appear in roughly a quarter of every question set you face. Items here are almost never definitional. The exam places you in a scenario where a design decision has already been made and asks you to evaluate it, extend it, or identify what is missing.

The most common trap is confusing adjacent concepts that share vocabulary. WIPS and WIDS, active and passive profiling, IKEv1 and IKEv2, ESP and AH: the exam exploits familiarity with the terms to test whether you actually know the operational difference. Candidates who have skimmed these topics lose marks because they pick the answer that sounds right rather than the one that fits the constraint in the scenario.

Items on dynamic segmentation reward understanding the policy enforcement point, not the physical topology. Items on Zero Trust reward mapping a stated security requirement to a specific Aruba capability. Items on PKI and IKE reward knowing which certificate field drives which authentication decision. Work through each sub-topic by asking what would break if you got it wrong, not by memorising what it is.

Where the previous domain covers policy and architecture, device hardening is about locking down the infrastructure itself. At 6%, this is a focused area with a narrow scope: securing management access to network devices and protecting the protocols those devices use to communicate. The marks are few but the mistakes are costly in practice, and the exam tests whether you know the advanced end of both problems.

How Device hardening is tested

Items in this domain test configuration logic rather than conceptual understanding. You will be given a scenario describing a management access requirement and asked which mechanism satisfies it, or you will be shown a partial configuration and asked what is missing or misconfigured.

TACACS+ authorization is a common trap. Candidates who know TACACS+ for authentication but have not worked through the authorization model lose marks when items ask about privilege levels, command authorisation sets, or the difference between what RADIUS and TACACS+ each handle in a management context. Multi-factor authentication items reward knowing which MFA method integrates with which management plane.

For protocol hardening, the exam tests substitution decisions: when SSH replaces Telnet, when SFTP replaces TFTP, and what the L2 and L3 protocol attack surfaces look like when default settings are left in place. Items reward knowing which specific protocol feature is the attack vector, not just that a protocol is insecure in general. The domain is small enough that thorough preparation across both sub-topics is achievable quickly.

Device hardening dealt with the infrastructure management plane. Secure WLAN shifts to the data plane on the wireless side: how clients authenticate, how traffic is inspected, and how the network responds when something goes wrong. At 12%, this domain has enough weight to move your score noticeably. The risk is treating it as a repeat of associate-level wireless knowledge when the exam operates at the design and integration level.

– AAA design and CPPM integration

Deploying AAA for WLANs with ClearPass Policy Manager means understanding the full authentication flow: how a wireless client reaches CPPM, which protocol carries the exchange, and how the policy result comes back to the AP or controller as an enforcement action. The exam tests this end-to-end, not just the CPPM side in isolation.

Integration between Aruba infrastructure and CPPM goes further than authentication. The exam expects you to understand how the infrastructure raises events and how CPPM acts on them: bouncing a port, changing a VLAN, applying a role. Candidates who know CPPM policy construction but cannot trace an event from trigger to enforcement action lose marks on these items. Know the CoA (Change of Authorization) flow and what initiates it.

– Firewall policies and rogue AP handling

Advanced firewall policies in the Aruba wireless world cover several distinct mechanisms: application-aware filtering through AppRF, Policy Enforcement Firewall (PEF) role-based rules, WIPS enforcement, web content classification (WebCC), and Unified Threat Management (UTM) features. The exam tests which mechanism is the right tool for a given security requirement. Candidates who treat these as interchangeable lose marks because the scenario will include a constraint that rules out all but one.

Rogue AP detection and mitigation has two separate dimensions. Detection asks how the infrastructure identifies an unauthorised AP: over-the-air scanning, SSID matching, wire-side correlation. Mitigation asks what the network does about it once found, and the Aruba options differ in aggressiveness and legal implication. Items reward choosing the mitigation method that fits the stated environment, not just the most aggressive one.

How Secure WLAN is tested

Items in this domain are almost always scenario-driven. You will be given a wireless deployment with specific client types, authentication requirements, or a security incident, and asked what to configure or change.

The most common mark-losing pattern is applying the right technology to the wrong problem. A candidate who knows AppRF well but reaches for it when the scenario calls for PEF role enforcement will get the item wrong even though both technologies are familiar. Read the scenario constraint first and let it eliminate options before you evaluate the remainder.

CPPM integration items reward understanding the direction of communication and the trigger. Many candidates know that CPPM sends a CoA but cannot identify what infrastructure event initiates the sequence. Items on rogue mitigation reward knowing the difference between containment and classification, and between what is technically possible and what is appropriate given the legal environment described in the scenario.

AAA items reward end-to-end flow knowledge. Tracing a failed authentication requires knowing every hop, not just the policy engine.

The wireless domain covered client access over the air. The wired equivalent runs on AOS-CX switches and carries the same AAA and segmentation logic into the physical port layer. At 19%, this is the second-heaviest domain in the exam and it overlaps conceptually with the first: dynamic segmentation and CPPM integration appear here again, but the configuration context is entirely different and the exam treats them as distinct skills.

– AAA, 802.1X, and certificate-based authentication

Deploying AAA for wired devices with CPPM follows a similar logical structure to the wireless case but the enforcement point is the AOS-CX switch port, not an AP or controller. The exam tests whether you can distinguish the wired-specific configuration steps from the shared CPPM policy logic.

802.1X authentication for APs is a specific sub-case that trips candidates up. An AP authenticating to a switch port is a device authenticating, not a user, and the certificate or credential handling differs accordingly. Know how the AP presents its identity and how the switch and CPPM process it.

Certificate-based authentication for users and devices extends this further. The exam tests the decision logic: when is a certificate sufficient, when is it combined with another factor, and how does CPPM evaluate a certificate against a policy rule. Knowing the EAP method that carries certificate credentials in each scenario is the key discriminator.

– Dynamic segmentation and CPPM event integration

Dynamic segmentation on AOS-CX means policy enforcement follows the user or device, not the port. The exam tests the operational model: how a role is assigned at authentication time, how it travels with the session if the endpoint moves, and what happens when CPPM changes the role mid-session via CoA.

Integration between Aruba wired infrastructure and CPPM is tested at the event-response level. The exam is not interested in whether you can navigate the CPPM GUI; it tests whether you understand what triggers an event, what CPPM can instruct the switch to do in response, and what the switch actually does at the port level. Candidates who know the policy model but cannot trace a specific event to a specific enforcement action lose marks here. The overlap with the wireless integration sub-topic is conceptual, but the switch-specific enforcement actions and the AOS-CX configuration syntax are distinct and both are in scope.

How Secure wired AOS-CX is tested

At 19%, this domain produces a substantial number of items and the scenarios tend to be more complex than those in the wireless domain. You will often be given a multi-step deployment situation where one element is misconfigured or missing and asked to identify it.

The trap in 802.1X items is conflating user authentication with device authentication. The exam places both in the same scenario and rewards correctly identifying which mechanism applies to which entity. Candidates who apply user-auth logic to AP onboarding scenarios lose marks consistently.

Dynamic segmentation items reward understanding the lifecycle of a role: how it is assigned, how it persists, and how it changes. Items on CPPM integration reward tracing the event chain from detection to enforcement action on the switch port. Knowing that CoA exists is not enough; the exam tests what the CoA message contains and what the switch does with it.

Certificate-based authentication items reward knowing the EAP method, not just the certificate format. Work through the authentication flow for each EAP type and know where certificates appear in each one.

The wired campus domain covered policy enforcement at the switch port. The WAN domain moves the boundary outward to branch and remote connectivity. At 5%, this is one of the lighter areas of the exam, but the two sub-topics are operationally specific and the exam will test them directly. Broad familiarity with VPN concepts from earlier topics is not enough here: the questions are about Aruba's specific WAN toolset.

How Secure the WAN is tested

Items in this domain test design decisions and deployment choices rather than low-level protocol mechanics. Aruba SD-Branch automates VPN deployment for branch WAN connectivity, and the exam rewards knowing what that automation handles and, critically, what it does not handle. Candidates who treat SD-Branch as a generic SD-WAN product lose marks on items that hinge on Aruba-specific behaviour.

Remote VPN deployment items test your ability to match a stated requirement to the correct deployment model. The exam distinguishes between remote access for individual users and branch-level VPN connectivity, and the configuration decisions differ. Items reward selecting the deployment type that satisfies the scenario constraint, not the one that is most familiar.

Because this domain carries only 5% of the marks, candidates sometimes under-prepare it expecting easy questions. The items are not harder than the rest of the exam, but they are specific. A candidate who has only a surface-level understanding of SD-Branch automation will find the scenario details in the stem eliminate their assumed answer. Cover both sub-topics deliberately rather than relying on carry-over knowledge from the VPN concepts in the first domain.

Securing the WAN established trust at the network edge. Endpoint classification asks a harder question: what is actually on the network, and can you trust what it claims to be? At 8%, this domain sits at the intersection of identity and enforcement. The sub-topics cover both the methodology for classifying endpoints and the Aruba tools that carry it out, and the exam tests whether you can connect the two.

How Endpoint classification is tested

Items in this domain test the relationship between classification method, data source, and enforcement outcome. The exam does not ask you to define active or passive profiling in isolation; it places you in a scenario where one method is producing incomplete data and asks what the gap is or how to fill it.

ClearPass and CPDI integration items reward understanding the data flow: what CPDI sees, what it passes to ClearPass, and how ClearPass uses that input to assign a device category or enforce a policy. Candidates who know each product independently but cannot describe the integration handshake lose marks on these items.

Deployment items test sequencing. Classification has to happen before enforcement can act on it, and the exam tests whether you know what has to be in place before a policy rule can reference a device category. Items reward correct ordering of deployment steps, not just familiarity with the individual steps.

The most common mark-losing pattern is treating classification as a one-time event. The exam rewards understanding that classification is continuous and that a device's assigned category can change as new data arrives, triggering a policy re-evaluation.

Endpoint classification tells you what is on the network. Threat detection asks what it is doing and whether that behaviour is acceptable. At 9%, this domain is analytical: items ask you to interpret data, reach a conclusion, and recommend a response. The skill being tested is judgment under incomplete information, and that is harder to fake with memorised facts than most other domains in this exam.

– Alerts, posture, and recommended action

Aruba Central generates alerts from wireless, wired, and WAN infrastructure, and the exam tests whether you can read one and understand what it is telling you. Investigating a Central alert means knowing which alert type maps to which underlying event, and what additional data you would need before acting. Items reward methodical triage, not immediate escalation or immediate dismissal.

Endpoint posture evaluation sits alongside alert investigation. Posture data tells you the state of the endpoint at connection time: patch level, running processes, certificate validity. The exam tests how posture findings feed into a policy decision. A device that fails a posture check is not simply blocked; the exam rewards knowing what options exist and which fits the scenario.

Recommending action based on Central alert analysis is the output step. Items here reward matching the severity and type of the alert to a proportionate response. Over-reacting and under-reacting are both wrong answers, and the scenario will contain the detail that distinguishes them.

– Packet capture interpretation

Interpreting packet captures is the most technical sub-topic in this domain. The exam does not expect deep Wireshark expertise, but it does expect you to read a capture and draw a security-relevant conclusion. That means recognising anomalous traffic patterns, identifying protocol misuse, and connecting what you see in the capture to a threat category.

The trap here is over-reading. Candidates who try to identify a specific CVE or attack tool from a packet-level description lose time and often land on a wrong answer. The exam rewards identifying the class of threat and the appropriate next step. Know what normal looks like for the protocols in scope for this exam, and let deviation from normal guide your conclusion. Packet capture in this domain is an investigative tool, and the item rewards the correct investigative conclusion, not the most detailed technical analysis.

How Threat detection is tested

Items in this domain are scenario-based and require you to synthesise information rather than recall a fact. You will be given alert data, a capture summary, or a posture report and asked what it means and what to do next.

The mark-losing pattern is reaching for a response before completing the analysis step. Items reward the correct sequence: observe, interpret, then act. Candidates who jump to a remediation action without identifying the threat correctly will find their chosen action is plausible but does not match the specific scenario.

Packet capture items reward recognising what is anomalous, not cataloguing every field in the frame. Alert items reward knowing the difference between an informational event and an actionable one. Posture items reward understanding the policy options available when a device fails a check.

At 9%, this domain has enough weight to affect a borderline result. Candidates who are strong on configuration topics but weak on analytical interpretation consistently drop marks here. Practice reading scenarios and forming a conclusion before looking at the options.

Threat detection asked you to identify what is wrong. Troubleshooting asks you to prove it and fix it. At 6%, this domain is procedural: the two sub-topics are about using Aruba-specific tools to gather data and make sense of it. The exam tests whether you can operate NAE scripts and packet capture in the Aruba environment, not just describe what they do.

How Troubleshooting is tested

Items in this domain test tool selection and output interpretation. For NAE, the exam rewards knowing what a script monitors, how to deploy it, and how to read the correlation output it produces. Candidates who know that NAE exists but cannot interpret a monitoring result lose marks when the item asks what the script output indicates.

Packet capture items in this domain are operationally focused. The exam distinguishes between capturing locally on an Aruba device and capturing remotely through Central, and the scenarios will specify a constraint that makes one method necessary. Items reward knowing which method applies and what its limitations are, not just that both methods exist.

The trap in both sub-topics is answering at the wrong level of abstraction. A candidate who gives a conceptual answer to a procedural question, or a procedural answer to an interpretive question, will get the item wrong even if the underlying knowledge is sound. Read the scenario to determine whether the item is asking you to select a tool, deploy it, or interpret its output, then match your answer to that demand. The domain is small but the items are precise.

Troubleshooting covered how to gather and interpret infrastructure data. This domain returns to endpoint classification but from the analytical side: given classification data that already exists, what does it tell you about risk, and how do you read it in CPDI? The focus is on drawing conclusions from data rather than setting up the classification pipeline.

How Endpoint classification is tested

Items here test data interpretation, not deployment. You will be given a description of endpoint classification output and asked what risk it represents or what action it warrants. The exam rewards reading classification data critically: a device categorised as one type but behaving as another is a risk signal, and items reward identifying that signal correctly.

CPDI-specific items test your ability to navigate and interpret the data that CPDI surfaces about network conversations and endpoint behaviour. Candidates who have only configured CPDI but have not worked through what its output looks like will find these items harder than expected. Know what CPDI shows, not just what it does.

The overlap with domain 6 is intentional. Domain 6 tested how classification works. This domain tests what you do with the results. Candidates who conflate the two lose marks by answering a data-analysis item with a deployment-step answer. Before committing to an answer, confirm whether the item is asking how classification is produced or what a specific classification result means. That distinction decides the answer in most items here.

The final domain is the narrowest in the exam. At 1%, it covers one specific capability: what CPDI can show you about network conversations on supported Aruba devices. The scope is deliberately tight. One topic, one tool, one set of capabilities. The risk is either over-preparing it at the expense of heavier domains or skipping it entirely and dropping a mark you could have kept.

How Forensics is tested

With only 1% of the exam, this domain will produce at most one or two items in any given sitting. Items reward knowing what CPDI can show about network conversations: which device pairs communicated, on which protocols, during which time windows, and on which supported Aruba hardware. The exam does not ask you to conduct a forensic investigation; it asks whether you understand the capability boundary of the tool.

The trap is scope creep. Candidates who answer with broader forensic methodology, third-party SIEM integration, or packet-level detail that CPDI does not provide will pick a plausible-sounding wrong answer. The item rewards the answer that accurately describes what CPDI does within its documented scope on supported devices, not what a full forensic toolkit would do.

Prepare this domain in proportion to its weight. One focused pass through the CPDI conversation visibility feature is sufficient. Do not let it consume time that belongs to the 26% and 19% domains. Bank the mark and move on.